Ledger has confirmed that a customer device tied to a wave of cryptocurrency thefts contained an unauthorized hardware implant. Every confirmed case so far traces to one Southeast Asian reseller, not to Ledger's own shop.
What happened
CoinDesk reported on 12 October that Ledger confirmed the implant on 10 October, after a draining incident disclosed on 9 October. An 11 October update said all confirmed cases involve devices sold by CryptoBilis, a reseller for Indonesia, Malaysia, and the Philippines. CryptoBilis has suspended hardware-wallet sales. Ledger says its internal systems and direct sales channels were not compromised.
On-chain researchers estimate $86 million to $93 million stolen from more than 300 wallets. Ledger has not confirmed that dollar total. Independent examination of suspect units describes extra circuitry under the screen, including a cellular modem, that can capture a recovery phrase during setup. The genuine secure element can still pass Ledger's device check, because the check validates Ledger's chip, not the absence of added hardware. Intact packaging is not proof the device is clean.
Who is affected
- People who bought a Ledger device from CryptoBilis, especially in the last 90 days.
- Buyers in Indonesia, Malaysia, and the Philippines are the confirmed cluster. Ledger has not tied the implant to its direct channel.
- Anyone who already initialized a suspect device. Resetting it and reusing the same recovery phrase does not help.
What to do now
Do not initialize an unused CryptoBilis device. If you already set one up, move the assets to a new recovery phrase generated on trusted hardware, and do not reuse the old phrase.
Contact Ledger only through its official support site. Ignore any message that asks for the recovery phrase. For anyone who buys sealed hardware through a reseller, treat the channel as part of the trust decision: a genuine-chip check and intact wrap do not prove the unit was not opened.
Source: CoinDesk, 12 October 2026. Ledger says unauthorized implant found in at least one device sold by CryptoBilis.
Also on the blog
- SonicWall SMA1000 CVE-2026-102255 CVSS 10 SSRF Under Attack
- Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
- Bricksforge CVE-2026-85097 CVSS 10 WordPress RCE Exploited
- CyberXero used Claude Code to steal 628,000 Ukrainian records
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.